Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

61–70 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#61

Post by snitko »

vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

Except that regulating things is not the same as holding a monopoly on regulations. If government is so completely confident that its currency is much more superior and stable, well, allow the competition! Make it legal to receive whatever I want to receive as a payment. Let businesses regulate the currency market and determine what currency is reliable. Oh wait, except that then government cannot tax you, of course.

Also, this incident has nothing to do with regulating bitcoins. It has to do with Rails and this particular exchange site, whose reputation is now damaged and who's going to lose business. Note how free market works great in this case: the organization costs people their lost money and will most likely go out of business. Unlike big banks.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#62

Post by danielweber »

mattlong wrote: post #58

It's likely due to confirmation bias, but it seems that almost every bitcoin company has some (usually careless or inexcusable) gap in their security...

Back when I cared about bitcoin, I'd go look at their websites for vulnerabilities and usually find them. Then I would tell them.

They never replied but did fix them.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#63

Post by tptacek »

jimktrains2 wrote: post #60
tptacek wrote: post #47

Earlier quoted context omitted.

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

Weren't there patches for rails, and release for rails with the patches, really quickly from release?

Yes, along with workarounds. I'm reacting to the inference that someone might wait to apply the patches because they broke the Asset Pipeline somehow.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#64

Post by eertami »

MrBra wrote: post #41

I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)

I'm pretty sure this would be news no matter how the exchange was exploited.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#65

Post by viraptor »

slajax wrote: post #46
lucisferre wrote: post #27

Earlier quoted context omitted.

A lot of banks get knocked off today http://www.fbi.gov/stats-services/publications/bank-crime-st...

Wow awesome link. That fully blows my mind.

I wasn't expecting this, but it feels good to know:

"Number of incidents in which deaths occurred: 3"

all 3 were the perpetrators rather than employees / customers. On the other hand 2 hostages being the employee's family members is disappointing. It's really sad that people really do involve the families of targets just for a bank robbery.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#66

Post by Xylakant »

jart wrote: post #45

> The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways) When they say "multiple times" I hope that means they're using PBKDF2 or bcrypt, because if they were simply using SHA1 then their users are even more doomed.

Given that this is a Remote Code Execution vulnerability I'd be very careful about the "not breached" as well. For all we know, the attacker could still have a shell or a rootkit on the server.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#67

Post by jvm »

vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

This argument seems to beg the question (in the actual meaning of that phrase), at least w.r.t Uber and AirBNB. All the problems they've had have come from the regulatory authorities, except for those one or two bad incidents on AirBNB which are pretty much unavoidable in a business like that. So is the argument that regulation is good because it's hard to cope with the regulators?

I just don't buy into the abrogation of common sense argument for regulation. If you let random people stay at your apartment, there's a chance they'll destroy it. If you're really worried about that then buy renter's insurance or don't sublet your place! If you give your bitcoins to some random website, there's a chance it'll get hacked! It's not like those people didn't have option of putting their money someplace more secure, like a bank.

I think regulation in general is really important for making our society a decent place to live, but when it makes reasonable activities effectively illegal that is generally a sign that it has passed that point and started making things worse.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#69

Post by MrBra »

eertami wrote: post #64
MrBra wrote: post #41

I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)

I'm pretty sure this would be news no matter how the exchange was exploited.

news, not town's fair adverts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#70

Post by [deleted] »

eertami wrote: post #64
MrBra wrote: post #41

I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)

I'm pretty sure this would be news no matter how the exchange was exploited.

[deleted]
Post reply on HN